ACME Protocol Explained
What the ACME Protocol Does
The ACME protocol is a standard that lets software request, validate, install and renew TLS certificates from a certificate authority without manual steps. ACME stands for Automated Certificate Management Environment. It is defined in RFC 8555 and is the protocol behind Let's Encrypt.
Before ACME, most certificates were bought and installed by hand. The buyer generated a key and a signing request, uploaded it through a web form, proved domain ownership by replying to an email, then downloaded and installed files. ACME turns these steps into messages between a client on the server and the authority's ACME service.
How an Order Moves Through ACME
The client first registers an account with the authority using its own account key. It then places an order listing the names it wants. For each name, the authority issues a challenge, a test that proves the client controls the domain. Once every challenge passes, the client submits its signing request and receives the certificate.
The standard defines three challenge types. HTTP-01 requires a specific file on a web server reachable under the domain. DNS-01 requires a TXT record in the domain's DNS. TLS-ALPN-01 requires a special response during a TLS connection on port 443. Only DNS-01 can validate wildcard names. The validation methods are discussed further in domain control validation.
Renewal and the Role of the Client
The client does more than issue certificates. It tracks expiry dates and requests a new certificate before the old one runs out. Most clients run on a schedule, which is what makes short certificate lifetimes workable. Many also update the web server with the new files, though the details depend on the software in use.
Validation depends on the server staying reachable and DNS staying correct. When a challenge fails, renewal fails too, and the certificate eventually expires. This is why certificate renewal needs monitoring even when it is automated.
Example: A Renewal That Quietly Fails
A company runs a web server behind a firewall that was tightened last year. Its ACME client uses the HTTP-01 challenge, but the authority can no longer reach port 80 on the server, so the challenges time out. The client logs an error at each attempt, and nobody reads the logs. Weeks later the certificate expires and visitors see a warning. Switching to DNS-01 would have avoided the reachability problem, at the cost of automating DNS changes.
Frequently asked questions
Is ACME the same as Let's Encrypt?
No. ACME is a protocol, a set of rules for how a client and a certificate authority communicate. Let's Encrypt is one authority that uses ACME, and other authorities support it too. A client that speaks ACME can work with any compatible authority.
Which challenge type should I use?
It depends on the setup. HTTP-01 suits a public web server that can answer on the domain. DNS-01 suits servers that are not publicly reachable, and it is required for wildcard names. TLS-ALPN-01 fits setups where port 80 is blocked but port 443 is open.